The vulnerability of the Xstream Java library for converting objects into XML or JSON format lies in insufficient validation of incoming requests. This allows attackers to retrieve data from internal resources that are not publicly accessible.

🗓️ 23 Jun 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Xstream vulnerability from insufficient request validation allows access to data via input stream.

Reporter	Title	Published	Views	Family All 98
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream	27 Feb 202103:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Xstream, which is a required product for IBM Tivoli Network Configuration Manager (CVE-2020-26258, CVE-2020-26259)	24 Mar 202107:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	8 May 202101:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream, Apache HTTP, Jackson Databind, OpenSSL, and Node.js affect IBM Spectrum Control	18 Feb 202115:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in xstream-1.4.9.jar	29 Jan 202517:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus	28 Jun 202120:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Test Management is vulnerable to arbitrary data access due to XStream ( CVE-2020-26258, CVE-2020-26259 )	4 Jul 202211:30	–	ibm

Vulners

Node

xstream xstreamRange<1.4.15

OR

novell opensuse_leapMatch15.2

Source	Link
debian	www.debian.org/security/2021/dsa-4828
x-stream	www.x-stream.github.io/CVE-2020-26258.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-26258
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1/
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
web	www.web.nvd.nist.gov/view/vuln/detail

21 Nov 2023 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 37.7

CVSS 27.8

EPSS0.82238

Xstream library insufficient validation internal data access input stream